AI consulting in Canada: how to tell an implementation partner from a slide deck

Most Canadian businesses are now shopping for AI help. Statistics Canada reported that 19.2% of Canadian businesses used AI in the second quarter of 2026, up from 6.1% in the second quarter of 2024 — a threefold jump in two years. Where there is demand, there are decks. And a polished deck is the single least reliable signal of whether a partner can actually deliver.

Here is the short answer. An implementation partner diagnoses your problem before naming a tool, builds something narrow that works, hands you a system and data you continue to own after they leave, and treats governance as part of the engineering — not an afterthought. A slide-deck vendor leads with the tool, quotes a platform licence, and leaves you with a dependency. The framework below is how to tell them apart before you sign.

1. Diagnosis before tooling

The first meeting is the tell. Ask a candidate partner what they would build for you, and a delivery-focused shop will refuse to answer until they understand your bottleneck. They will ask about call volume, missed enquiries, where handoffs break, what your team does manually today, and what "better" would measurably look like. A vendor will answer immediately — because the answer is always their product.

Good diagnosis produces an unglamorous artifact: a written statement of the specific, measurable problem and the smallest intervention that could move it. If the recommended solution would be the same regardless of what you said, you are being sold a licence, not a solution.

What to ask

• "Walk me through a case where you recommended against AI, or a smaller build than the client wanted."
• "What would you measure in the first 60 days, and what number would tell us this failed?"

2. You own the data and the system after they leave

This is where dependency gets built or avoided. A real partner leaves you with credentials, exportable data, documentation, and a system that keeps running without them on retainer. Before you sign, get explicit answers on ownership: who holds the accounts, whether your data exports in a usable format, whether prompts and configurations are yours, and what happens on the day you part ways.

Under Canada's federal PIPEDA, your organization remains accountable for personal information you collect — including information handled by a service provider on your behalf. That accountability does not transfer to your vendor. So "who owns and controls the data" is not a philosophical question; it is a compliance one. If a partner cannot cleanly answer it, that is your answer.

3. Realistic pilots, not moonshots

Ambitious pilots fail quietly and expensively. A credible partner scopes a pilot you could kill in a month without regret: one workflow, one measurable outcome, a defined exit. Answering and triaging after-hours calls, for instance, is a bounded problem with an obvious metric — bookings captured that would otherwise have been lost. "Transform your operations with AI" is not a pilot; it is a slide.

The honest version of this pitch includes what the pilot will not do, the edge cases a human still handles, and the conditions under which you would scale it or shut it down. Productized tools help here because they are already running in production for other businesses — the proof is that it ships. Our own AI receptionist, ALMATalk, exists precisely so that "does this actually work on real calls" is a thing you can watch, not a thing you have to imagine from a diagram.

4. Governance built in, not bolted on

In Canada, AI touches personal information, and personal information is regulated. A partner who cannot speak plainly about the rules below is telling you they have not shipped in this jurisdiction.

Quebec's Law 25

If you handle the personal information of Quebec residents, Law 25 (administered by the Commission d'accès à l'information, the CAI) applies. It carries real teeth through two separate regimes — administrative monetary penalties and penal fines. For the penal offences, the fine range runs from $15,000 to $25,000,000, or, if greater, an amount equal to 4% of worldwide turnover for the preceding fiscal year — whichever is greater, within that framework. The point is not the exact figure; it is that a competent partner knows penalties can reach the tens of millions or a share of global turnover, and designs accordingly.

Law 25 also includes section 12.1, on automated decision-making: when a decision is based exclusively on automated processing, you must inform the person and, on request, let them submit observations. Routine scheduling or booking is generally not an "exclusively automated decision" with legal or similar effect. Screening, scoring, or eligibility decisions are far more likely to trigger it — so the distinction should shape how any AI tool is used, not just whether one is used.

The federal picture

Be wary of any partner citing the Artificial Intelligence and Data Act (AIDA) as law. AIDA was part of Bill C-27, which died when Parliament was prorogued in January 2025. It is not in force. As of 2026 the federal AI and privacy legislative vehicle is Bill C-36 — a current bill, not passed law. Meanwhile, PIPEDA remains the operative federal private-sector privacy statute. A partner who gets this wrong is working from stale material.

Cross-border processing

Many capable AI tools process data on infrastructure outside Canada, and that is not, by itself, prohibited. The Office of the Privacy Commissioner (priv.gc.ca) treats a transfer for processing as a use of the information, governed by the accountability principle: your organization stays accountable, must ensure a comparable level of protection through contractual measures, and must be transparent that data may be processed outside Canada — and could therefore be accessible to foreign courts or authorities. The honest position is not "your data never leaves Canada." It is "here is where it is processed, here is the contractual protection, and here is what we tell your customers."

Language obligations in Quebec

Quebec's Charter of the French Language (Bill 96) creates a general right for consumers to be served and informed in French. It does not impose a specific rule about, say, answering the phone in French. Bilingual capability is worth having because it supports your French-language service obligations — frame it that way, not as satisfying a mandate that does not exist in those terms.

This section is general information, not legal advice. Confirm your obligations with a qualified Canadian privacy or commercial lawyer before relying on any of it.

Putting it together

Run every prospective partner through four questions. Did they diagnose before prescribing? Will you own the system and data when they walk out? Is the pilot small enough to fail safely? Can they discuss Canadian privacy law without hand-waving? A slide deck can survive one of these questions. It rarely survives all four.

Statistics Canada's data offers one more caution: of the businesses using AI, 28.2% reported using virtual agents or chatbots — a share of AI-adopters, not of all businesses. The technology is common; competent delivery of it is not. Buy the delivery.

If you want to see what "it ships" looks like on a concrete workflow, our productized AI receptionist is at almatalk.ca.